US State Privacy Law Notice
Effective: July 24, 2026
This US State Privacy Law Notice supplements our main Privacy Policy and applies to residents of US states with comprehensive consumer privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and similar laws in other states. It is provided by Grow Labs LLC ("Grow Labs," "we," "us," or "our"), the business responsible for the Safr mobile application. If you live in Washington or Nevada, also see our Consumer Health Data Notice, which covers the specific rights those laws give you over health data.
1. A note on how Safr is built
Safr has no login and no account. We do not ask for your name, email, or phone number to use the app. Instead, your install is identified by a random device identifier (an "install id") that is not tied to your real-world identity. The detailed cycle and health information you log, your period, intercourse, cervical-mucus, symptom, Plan B / emergency-contraception, and LH-test entries, your cycle and period lengths, and the in-app risk estimates Safr calculates, all stay on your device and are not collected by us. Specific, clearly labeled features (optional analytics, advertising measurement, AI chat and photo analysis, connecting Oura, and the optional Safr Cycle Science Study) are the exceptions, and they are described below.
2. Categories of personal information we collect
Under the CCPA/CPRA, the following describes the categories of personal information we may collect, the sources, and why we collect it. We collect most of these only when you opt in to a feature, so many users generate none of them. We do not collect Social Security numbers, driver's license numbers, financial account numbers, precise geolocation, biometric identifiers, or contents of your mail, email, or messages.
| CCPA category | Examples in Safr | Source | Purpose |
|---|---|---|---|
| Identifiers | Random install id; pseudonymous device identifier used to group analytics events. In the US, for users 16+: on iOS your device advertising identifier (IDFA), only if you grant Apple's App Tracking Transparency (ATT) prompt; on Android the Google advertising ID, on by default with an opt-out in Settings. If you join the research study, a separate random study ID generated on your device, which is never linked to your install id, your advertising identifier, or your analytics profile. | Generated on your device; iOS ATT identifier from Apple if you grant it; Android advertising ID from Google Play services. | Run the app, group analytics from the same install, (with consent) measure advertising, and, for participants, key the research record. |
| Characteristics / protected classifications (approximate age) | Your approximate age in years, derived on your device from your date of birth. For analytics we never receive your date of birth or birth year, only the derived age. In the UK and EU/EEA, age is not attached to the analytics profile of a known minor; elsewhere it is attached for opted-in users aged 16 or older. If you join the research study, your birth year (never your full date of birth) is included in your research record, keyed to your study ID. | You, during onboarding (sent to analytics only if you opt in, and included in research data only if you join the study). | Understand the age mix of our users, apply age-based protections, and, for participants, analyze research results by age. |
| Commercial information | Subscription status, the product purchased, plan tier, whether a purchase is a free trial, and the transaction amount and currency. | Apple App Store and our subscription tools; sent to analytics only if you opt in. | Provide and manage subscriptions, prevent fraud, and understand which plans people choose. |
| Internet or other electronic network activity | Which screens you open, which features you use (not their contents), notification interactions, permission outcomes (such as notifications and the ATT prompt), onboarding-step progress, build channel (whether the install is from the App Store or is internal/test), app version, and platform. | Your use of the app (collected only if you opt in to analytics). | Understand usage, debug, and improve the app. |
| Sensitive personal information | Your reproductive-health goal for using Safr (birth control vs pregnancy test) is sent to analytics for adults, and for users 16 or older outside the UK and EU/EEA; under-16s anywhere, and all under-18s in the UK and EU/EEA, send "unknown." Body-temperature data from Oura (if you connect it) and the health entries you log are reproductive and health information. See Section 6 on sensitive PI. If you join the optional Safr Cycle Science Study, your detailed cycle logs also leave your device: wearable temperature readings, period dates and flow, LH (ovulation) test results, cervical mucus observations (never photos), symptom tags (never written notes), logged sexual activity including protection use, emergency contraception dates, pregnancy test results, your birth year, your cycle statistics, the pregnancy prevention approach and birth control method you picked during setup, whether a temperature wearable is connected, and your reasons for using Safr, all keyed to a random study ID. | You (onboarding answer, on opt-in), Oura or Apple Health (if you sync a temperature wearable), and your own logs if you join the research study. Otherwise your detailed health logs stay on your device. | Understand retention by goal, power cycle insights, answer your questions in AI features you choose to use, and, for adults who join, carry out the Safr Cycle Science Study. |
We do not send your detailed cycle, intercourse, cervical-mucus, symptom, Plan B, or LH-test logs, your cycle or period lengths, your in-app risk estimates, your name or email, or your chat content or uploaded photos to our analytics or advertising partners. Those either stay on your device, or are sent to the AI provider when you use AI features (Section 4), or, if you have joined the Safr Cycle Science Study, are sent to our own research database under a random study ID (Section 3). We never send your name, your email, your chat content, or your uploaded photos anywhere for research.
3. Where personal information goes (service providers and recipients)
We disclose personal information to the vendors below so they can perform services for us. Except for the advertising-measurement sharing described in Section 5, these are "service providers" or "processors" that are contractually limited to using the data for us. We do not sell personal information for money.
| Recipient | Categories disclosed | Purpose |
|---|---|---|
| PostHog (product analytics, only if you opt in to "Share usage data") | Identifiers (install id); approximate age and reproductive-health goal (under-16s anywhere, and under-18s in the UK and EU/EEA, send "unknown"); internet/usage activity; commercial information (subscription, plan, trial flag, amount, currency); app version, platform, and build channel. | Pseudonymous product analytics to understand usage and improve the app. No detailed health logs are sent. |
| Singular, our mobile measurement partner, which forwards conversions to ad networks including TikTok and Meta (only if ad tracking is active and you meet the age and ATT conditions in Section 5) | Identifiers (and, for a US user who meets the minimum advertising age and grants ATT, the device advertising identifier); commercial information for a subscription event (product, plan, amount, currency). No health data. | Measure which advertising campaigns lead people to install and subscribe. |
| OpenAI (only if you use AI chat or photo analysis) | Your chat message and a summary of your Safr data (cycle dates, symptoms, intercourse and Plan B entries, recent cervical-mucus and LH results, and your in-app risk estimate); for photo analysis, the photo you choose. | Generate a personalized AI answer or analyze the photo. Not used for advertising and not sold. |
| Apple App Store | Commercial information (subscription transactions). | Process and manage subscription payments. We receive subscription status, not your full card details. |
| Superwall | Identifiers and subscription/paywall interaction data. | Present paywalls and process subscription state. |
| Oura (Ōura Health Oy, EU-based) | Source of overnight body-temperature data you authorize. OAuth tokens are stored in your device's secure keychain; the token exchange is proxied through our backend. | Import temperature to inform your on-device cycle insights, only if you connect Oura. |
| Our cloud hosting / backend, hosted on Railway | Whatever a given feature requires: the AI request, the Oura token exchange, your install-id-keyed deletion request, and, if you join the Safr Cycle Science Study, the research snapshot described in Section 2, keyed to your random study ID and carrying no name, email, install id, or advertising identifier. | Operate the AI proxy, the Oura token exchange, and deletion requests, and, for participants, store research data in our research database. Railway acts as our processor under contract. Not used for advertising and not sold. |
4. AI chat and photo analysis
If you use Safr's AI chat, your message and a summary of your Safr data (such as your cycle dates, logged symptoms, intercourse and Plan B entries, recent cervical-mucus and LH results, and your in-app risk estimate) are sent, through our backend, to OpenAI so the assistant can answer you. If you use optional photo analysis (for example, cervical-mucus or LH-test photos), the photo you choose is sent the same way. Safr asks for your explicit agreement before anything is sent the first time, and if you do not agree, nothing is sent. We do not use these features for advertising and do not sell this data. Our backend passes these requests to OpenAI and does not retain your chat messages or photos after the request is processed. Under OpenAI's standard API terms, your content is not used to train its models and is retained only briefly (up to 30 days) for abuse monitoring before deletion.
5. "Sale" and "share" of personal information, and your opt-out
We do not sell your personal information for money, and we never share your health, cycle, or reproductive data with advertising networks.
We do work with Singular, a mobile measurement partner, to understand which advertising campaigns bring people to Safr. Two conversion signals are involved: a pre-paywall "registration" signal when you finish onboarding, and a subscription signal (carrying the product, plan, amount, and currency, but no health data). Singular handles them in two distinct modes. In the first, aggregate mode, Singular acts as our service provider / processor under contract: it processes these events for us keyed to a random device-scoped id, with sharing to advertising partners restricted, to produce anonymous, aggregate campaign reports (on iOS through Apple's privacy-preserving SKAdNetwork, which reports campaign results to ad platforms with no user-level identifier). We treat this as processing on our behalf, not a sale or share. In the second, user-level mode, Singular additionally forwards these conversion signals, with device identifiers, to the ad network that showed you the ad (including TikTok), and the app also sends them directly to Meta. Because that mode involves disclosing device and commercial identifiers to advertising partners, it may count as a "sale" or a "share" for cross-context behavioral advertising under the CCPA/CPRA and similar state laws. For that reason we treat it as a share you can opt out of, and we do not claim that we never share.
Both modes are US-only, limited to users who meet the minimum advertising age (16), and off for anyone who has not opted into usage data. The user-level mode on iOS additionally requires that you have allowed Apple's App Tracking Transparency (ATT) prompt: your device advertising identifier (IDFA) is never accessed and user-level forwarding is off unless you allow that prompt. On Android, where no comparable system prompt exists, user-level measurement is on by default for eligible US users using the Google advertising ID (you can reset or delete it in Android's system privacy settings). On either platform you can turn all ad measurement off in Settings at any time ("Share data with ad partners"). Outside the United States (including the UK, the EU/EEA, and Canada) neither mode runs at all.
6. Sensitive personal information and your right to limit
Some information Safr handles is "sensitive personal information," including health and reproductive data and your reproductive-health goal for using Safr. We use sensitive personal information only to provide the features you ask for (such as cycle insights, AI answers you request, for adults who opt in to analytics, understanding retention by goal, and, for adults who choose to join the Safr Cycle Science Study, carrying out that research). We do not use or disclose sensitive personal information to infer characteristics about you, and we do not use it for advertising. Because we limit our use of sensitive personal information to these permitted purposes, there is generally nothing further to restrict, but you can still email us to ask us to limit its use, and you can withdraw the relevant consents in the app (turn off analytics, disconnect Oura, or leave the research study).
Research and sensitive personal information. The Safr Cycle Science Study is an optional, ongoing observational study of how well wearable temperature tracking reflects real menstrual cycles and pregnancy outcomes. It is opt-in, adults only (18 or older), limited to users who sync a temperature wearable, and never a condition of using Safr. We ask once, right after you connect a wearable, and you can join, decline, or change your mind at any time in Settings under App preferences. Research data is keyed to a random study ID that is never connected to your name, your email, your device identifiers, or your analytics profile, and results are only ever reported in aggregate, combined across many participants, so no individual can be identified. We never use your name, contact details, free text notes, photos, chat messages, or advertising identifiers for research, and research data is never sold and never disclosed to advertising networks. To leave the study, turn off Share data for research in Settings; to also delete research data already collected under your study ID, email [email protected].
7. Your rights
Depending on your state, you may have the right to:
- Know and access the categories and specific pieces of personal information we have, the sources, the purposes, and the categories of recipients.
- Delete the personal information we hold about you.
- Correct inaccurate personal information.
- Opt out of any sale or share of your personal information for cross-context behavioral advertising (see Section 5).
- Limit the use of sensitive personal information to permitted purposes (see Section 6).
- Non-discrimination: we will not deny you service, charge a different price, or give you a lesser experience for exercising these rights.
- Appeal a decision we make on your request (Section 9).
8. How to exercise your rights, and how we verify you
You have direct, in-app controls, which are usually the fastest way to exercise your rights:
- Access / data portability: Settings, then "Export my data," gives you a structured JSON copy of your on-device data plus the identifiers and consent records that link to any server-side copy.
- Delete: Settings, then "Delete all my data," wipes the data on your device, opts out and resets your analytics identifier, detaches advertising attribution, erases your Oura tokens, and sends a deletion request keyed to your install id so we can erase the related server-side analytics record. It does not by itself delete research data already collected under your study ID; email us for that.
- Opt out of sale/share: Settings, then turn off advertising attribution / ad tracking.
- Withdraw consent: turn off analytics, turn off ad tracking, use "Disconnect Oura," or turn off "Share data for research" in Settings.
- Leave the research study: Settings, under App preferences, turn off "Share data for research." Safr then stops using your new data for research. To also delete research data already collected under your study ID, email [email protected]. Data already included in published aggregate results cannot be recalled, but it never identifies you.
You can also email [email protected] to make any request. Because Safr has no account and we do not hold your name, the simplest way for you to exercise these rights is the in-app controls, which act on your own device and install. For requests by email, we verify you to the extent we can by matching the install id associated with your data (which the app can show or send) and corresponding with you at the email you use to contact us. If we cannot verify a request to the standard the law requires, we may not be able to act on it, and we will tell you why.
Authorized agents. You may use an authorized agent to submit a request. We may ask the agent for proof that you gave them written permission to act for you, and we may ask you to verify your own identity or confirm the agent's authority directly with us.
9. Right to appeal
If we decline to act on your request, you may appeal by emailing [email protected] with the subject line "Privacy appeal." We will respond to your appeal in writing within the time your state's law allows and explain our decision. If your appeal is denied, you may contact your state attorney general.
10. Minors
Safr applies a region-aware age gate at onboarding (a minimum age of 16 in the US, 18 in the UK, and the applicable digital-consent age, 13 to 16, elsewhere in the EU/EEA; 13 where no higher age applies). Advertising attribution is US-only and disabled for anyone under 16. In the UK and EU/EEA, we do not attach an approximate age or a reproductive-health goal to the analytics profile of a known minor; their goal is sent as "unknown." Elsewhere, a user aged 16 or older who opted in has these recorded; we never record this for anyone under 16. We do not sell or share the personal information of consumers we know to be under 16. The Safr Cycle Science Study is adults only: it is offered only to users who are 18 or older, whatever the local minimum age for using Safr, so a minor is never invited to join.
11. Retention
- On your device: your logs and settings stay until you delete them in the app or remove the app.
- Analytics and advertising measurement: retained for up to 2 years, or sooner if you ask us to delete your data.
- Subscriptions: kept while your subscription is active, plus limited records we are legally required to keep.
- Research study, if you join: raw research data keyed to your study ID is kept for the duration of the Safr Cycle Science Study and for up to 5 years after it ends, then deleted or irreversibly anonymised. You can ask us to delete it sooner by email.
12. Contact us
Grow Labs LLC
8 The Green, Suite A, Dover, DE 19901
Privacy contact: [email protected]